Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Oracle PeopleSoft PeopleTools zero-day (CVE-2026-35273)
Oracle security alert 10 Jun 2026. CVSS 9.8.
- Disclosed
What happened
- Oracle security alert 10 Jun 2026. CVSS 9.8. Pre-auth SSRF leading to RCE.
- Affected: PeopleTools 8.61 and 8.62.
- Exploited by UNC6240 (ShinyHunters) between 27 May and 9 Jun. 300+ instances at 100+ organizations, mostly universities. KEV: 12 Jun 2026.
Live scores
Live scores
CVE-2026-35273- EPSS
- 0.967
very likely to be attacked soon - VEDAS
- 0.988
strong exploit evidence - On CISA KEV
- Yes, since 2026-06-12
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273
- https://bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.